Site Search - Liferay Learn

Does having a script in a button fragment qualify as a potential XSS vulnerability?

Issue We can put a Javascript code in the Button fragment's URL field, so it can be executed when we click on the button, like javascript:alert(document.cookie) Can that be a vulnerability to Cross Site...

Does Liferay support more than one SAML connection?

legacy

Issue Can Liferay connect to more than one Service or Identity Provider? Environment DXP 7.0 DXP 7.1 DXP 7.2 DXP 7.3 DXP 7.4 Resolution Yes, Liferay does support more than one SAML or Identity Provider...

Does having a script in the Analytics section qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in the Matomo (DXP 7.4) or Piwiki (DXP 7.0-7.3) field where the code can be executed on every other page Go to a Site's Configuration -> Site Settings -> Analytics Under the...

How can we set the requireSSL property?

legacy How To

Issue How can we enable the requireSSL attribute in Liferay? Environment Liferay DXP 7.0+ Resolution You can set that in your JDBC properties:...

0Auth2.0 issues new token every time even before token's expiration time

legacy

Issue The access_token expiration default is set to 10 minutes. When invoking the /oauth2/token before the previous token expires, a brand new token is issued instead of the original token. Environment DXP 7.4...

Unable to process SAML request

legacy Troubleshooting

Issue Some users are unable to login via SAML Steps to reproduce: Login User for the first time The user gets logged-in successfully Now, log out and try logging in again Result: Throws unable to process SAML...

After configuring a CDN, Liferay does not load images and throws error in browser console

legacy Troubleshooting

Issue We have configured a CDN with our Liferay environment. The portal is unable to load Liferay JS/CSS and images and we see errors in the browser console: Access to XMLHttpRequest at 'https...(CDN)' from origin...

Does CVE-2022-1471 affects DXP 7.4?

legacy Troubleshooting

Issue Our scanner reported that the Liferay DXP image as well as the Elasticsearch image are vulnerable to CVE-2022-1471, which is about an issue with SnakeYaml. Could you please confirm if we have to address this...

AuditEvent not saved after migrating from Portal 6.2 to DXP 7.4

legacy Troubleshooting

Issue After migrating to DXP 7.4. If we use the portal normally, there aren't new entries in Audit_AuditEvents table. Environment Liferay DXP 7.4 Resolution Go to System Settings -> Audit -> Persistent...

How to extract the okta authorization token for each user?

legacy Troubleshooting

Issue Once users log in to Liferay, the user should get redirected to Okta. After successful authentication, Okta is supposed to return an authorization token for that specific user. Concern: After successful Okta...

Unable to extend user session on Weblogic

legacy Troubleshooting

Issue When I call Liferay.Session.extend(); from Liferay 7.4 running on Weblogic, the user session terminates. Environment DXP 7.4 Weblogic Resolution This behavior is resolved by LPS-190923. Please open a help...

XSS and Web Content editing

legacy Troubleshooting

Issue Web Content Editing If a script is added to the content field and published, the script is executed when the article is displayed. Accessing the page triggers an alert each time. Allowing such content could...

Where is the password reset email set up and in what priority order?

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us....

I am redirected to the home guest page after login with SAML

legacy Troubleshooting

Issue After logging in with SAML, I am redirected to the Home Page of a non-logged-in user. I am redirected back to the Portal login screen after login with SAML Environment Portal 6.2 DXP 7.0+ Resolution This can be...

Does Liferay DXP validate Session Identifiers?

legacy

Issue Does Liferay DXP validate Session Identifiers? And yes, Liferay does validate Session Identifiers! Environment Liferay DXP Resolution As for the session configuration in the portal we have the...

Does CVE-2016-1000027 affect Liferay?

legacy

Issue Security scan shows CVE-2016-1000027 as an active vulnerability, is Liferay affected? Environment DXP 7.4 Resolution CVE-2016-1000027 is known to us, and we can confirm that Liferay should not be vulnerable, as...

Does CVE-2022-47966 affect Liferay?

legacy

Issue Our security scan has shown CVE-2022-47966 as an active critical vulnerability. Is Liferay affected? Environment DXP 7.2 Resolution The out-of-the-box Liferay product is not affected by this vulnerability. So,...

Insecure HTTP methods

legacy How To

Issue HTTP methods like HEAD, OPTIONS, TRACE may provide information about the application that can be used in attacks like XST, CSRF, steal of sensitive information. How we can disable insecure/unnecessary http...

Tomcat's vulnerability CVE-2023-44487

legacy

Issue Is DXP 7.4 affected by Tomcat's Rapid Reset CVE-2023-44487? Environment Liferay DXP 7.4 Resolution If user is not using Tomcat with DXP, then it is not affected by “Tomcat's Rapid Reset CVE-2023-44487”. If...

Is Liferay vulnerable to CVE-2024-38819: SpringFramework (spring-core-5.3.39)?

legacy

Issue CVE-2024-38819: Path traversal vulnerability in functional web frameworks (2nd report) is related to the usage of WebMvc.jar. Is Liferay vulnerable to this vulnerability? Environment Liferay DXP 7.3...

Search Results